darkcloud | d1fcb7d17c9a3b228c9ae974d5ec478212c77eb17f4abff26c400f92dc42a6d0

Analysis

max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
15/08/2023, 07:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Overdue OA payment.exe
Size 759KB
Sample230815-jbee3abd9s
SHA256 d1fcb7d17c9a3b228c9ae974d5ec478212c77eb17f4abff26c400f92dc42a6d0
MD5 98bb403612f7b703221cf8ff8024a2f5
SHA1 d5ae4208fe0f8de0def874148de4bd6c6b3b0ac0
SHA512 76ffc762d758e5ffa3baf633493f776f21dba5e80ac2febd308b6f1bece0b4a4d66ed4d4de75aa1cf58e19d27549b320c3708879955acbc2113767d5e2de855f
SSDEEP 12288:4qq8jW8aZZQ4UZ+9DHIowluNPuQtCBipQLpvmUMykv0V56/qUVQ0p+1j2lj5:1qCW874C+9Doowludhty5CykvA56/qK9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcloud stealer

Malware Config

Extracted

Family

darkcloud

https://api.telegram.org/bot6201772437:AAE8z2HCV4dlViF8O7_bVozdyvuR6EkBCPA/sendMessage?chat_id=1909112828

Signatures

DarkCloud
An information stealer written in Visual Basic.
stealer darkcloud

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1800 set thread context of 3068	1800	Overdue OA payment.exe	92

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1800	Overdue OA payment.exe
1800	Overdue OA payment.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3068	Overdue OA payment.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1800	Overdue OA payment.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3068	Overdue OA payment.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 2932	1800	Overdue OA payment.exe	91
PID 1800 wrote to memory of 2932	1800	Overdue OA payment.exe	91
PID 1800 wrote to memory of 2932	1800	Overdue OA payment.exe	91
PID 1800 wrote to memory of 3068	1800	Overdue OA payment.exe	92
PID 1800 wrote to memory of 3068	1800	Overdue OA payment.exe	92
PID 1800 wrote to memory of 3068	1800	Overdue OA payment.exe	92
PID 1800 wrote to memory of 3068	1800	Overdue OA payment.exe	92
PID 1800 wrote to memory of 3068	1800	Overdue OA payment.exe	92
PID 1800 wrote to memory of 3068	1800	Overdue OA payment.exe	92
PID 1800 wrote to memory of 3068	1800	Overdue OA payment.exe	92
PID 1800 wrote to memory of 3068	1800	Overdue OA payment.exe	92

C:\Users\Admin\AppData\Local\Temp\Overdue OA payment.exe
"C:\Users\Admin\AppData\Local\Temp\Overdue OA payment.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Users\Admin\AppData\Local\Temp\Overdue OA payment.exe
  "C:\Users\Admin\AppData\Local\Temp\Overdue OA payment.exe"
  2⤵
  PID:2932
- C:\Users\Admin\AppData\Local\Temp\Overdue OA payment.exe
  "C:\Users\Admin\AppData\Local\Temp\Overdue OA payment.exe"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:3068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1800-139-0x0000000006080000-0x000000000611C000-memory.dmp

Download

memory/1800-134-0x0000000000940000-0x0000000000A02000-memory.dmp

Download

memory/1800-135-0x0000000005A30000-0x0000000005FD4000-memory.dmp

Download

memory/1800-136-0x0000000005480000-0x0000000005512000-memory.dmp

Download

memory/1800-137-0x0000000002F60000-0x0000000002F70000-memory.dmp

Download

memory/1800-138-0x00000000030D0000-0x00000000030DA000-memory.dmp

Download

memory/1800-133-0x0000000075390000-0x0000000075B40000-memory.dmp

Download

memory/1800-140-0x0000000075390000-0x0000000075B40000-memory.dmp

Download

memory/1800-141-0x0000000002F60000-0x0000000002F70000-memory.dmp

Download

memory/1800-146-0x0000000075390000-0x0000000075B40000-memory.dmp

Download

memory/3068-142-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/3068-145-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/3068-149-0x0000000000400000-0x0000000000462000-memory.dmp

Download